nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Vulnerability in Tomcat config under Confluence - QID 11827

Lloyd Chandler

Our Confluence server was flagged by Qualys scan for the 11827 vulnerability. 
The following headers are not present:

Header set X-Content-Type-Options: "nosniff"
Header set X-XSS-Protection: "1; mode=block"
Header set X-Frame-Options: "sameorigin"

As we are using the default Confluence installation which is using Apache Tomcat (built in or something),
how do I add these headers to the default config?

Accepted answers

All comments

Edwin Kyalangalilwa

Hi Lloyd,

This link will be helpful. Refers to web.xml

https://geekflare.com/tomcat-http-security-header/

Lloyd Chandler

thanks - looked at that reference and another - I made the correct changes to the web.xml file located under ..\confluence\conf - however, after making the changes, it's still not working - the headers are not appearing..

I updated web.xml to contain the following - uncommented:

<span><filter></span>
        <span><filter-name></span><span>httpHeaderSecurity</span><span></filter-name></span>
        <span><filter-class></span><span>org.apache.catalina.filters.HttpHeaderSecurityFilter</span><span></filter-class></span>
        <span><async-supported></span><span>true</span><span></async-supported></span>
        <span><init-param></span>
          <span><param-name></span><span>antiClickJackingEnabled</span><span></param-name></span>
          <span><param-value></span><span>true</span><span></param-value></span>
        <span></init-param></span>
        <span><init-param></span>
          <span><param-name></span><span>antiClickJackingOption</span><span></param-name></span>
          <span><param-value>SAMEORIGIN</span><span></param-value></span>
        <span></init-param></span>
    <span></filter></span>
  <span><filter-mapping></span> 
    <span><filter-name></span><span>httpHeaderSecurity</span><span></filter-name></span> 
    <span><url-pattern></span><span>/*</span><span></url-pattern></span>
<span></filter-mapping></span>

Edwin Kyalangalilwa

Did you try restarting after the changes?

Lloyd Chandler

yep - if that means restarting the Confluence service..reboot, no..

Timothy

While the other comment by @Edwin Kyalangalilwais good, you should also consider "masking" this vulnerability by fronting your Tomcat with a proxy server in front of it. For example, Apache:

There is no easy way to upgrade Tomcat that run's Jira and Confluence. So, the best workaround is to mask whatever's running in the background with a good proxy and webserver setup.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

jira